PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-108861 erpipe-org CVE debrief

CVE-2026-108861 Odoo MCP Information Disclosure via execute_method Tool. This vulnerability allows MCP clients to bypass field-level ACL, potentially leading to information disclosure in Odoo MCP deployments. Defenders should assess exposure and prioritize verification and mitigation. The vulnerability exists in Odoo MCP versions 1.0.0 through 1.3.2 and involves invoking the execute_method tool to access denied fields unredacted. The CVE record and source item provide details on the information disclosure vulnerability, but additional verification is required for exploitation, impact, and remediation.

Vendor
erpipe-org
Product
Odoo MCP
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-11
Original CVE updated
2026-10-11
Advisory published
2026-10-11
Advisory updated
2026-10-11

Who should care

Defenders responsible for Odoo MCP deployments should assess exposure and prioritize verification and mitigation. This includes reviewing system configurations, verifying vulnerability in versions 1.0.0 through 1.3.2, and applying patches or mitigations as available. Additionally, security teams should monitor for potential information disclosure and review compensating controls for exposed systems.

Why it matters

Defenders should care about CVE-2026-108861 because it allows MCP clients to bypass field-level ACL, potentially leading to information disclosure in Odoo MCP deployments.

  • Potential information disclosure due to bypassed field-level ACL
  • Need to verify vulnerability in Odoo MCP versions 1.0.0 through 1.3.2
  • Potential impact on data confidentiality

Technical summary

Odoo MCP versions 1.0.0 through 1.3.2 contain an information disclosure vulnerability that allows MCP clients to bypass field-level ACL by invoking the execute_method tool. This could lead to unauthorized access to sensitive information. The vulnerability is specific to the execute_method tool and involves bypassing field-level access control lists (ACL). Defenders should prioritize verifying the vulnerability and applying patches or mitigations as available. The technical details indicate a need for careful review of system configurations and potential exposure.

Defensive priority

Defenders should prioritize verifying the vulnerability in Odoo MCP versions 1.0.0 through 1.3.2 and applying patches or mitigations as available.

Recommended defensive actions

  • Verify Odoo MCP versions 1.0.0 through 1.3.2 for vulnerability
  • Apply patches or mitigations as available
  • Monitor for potential information disclosure
  • Review compensating controls for exposed systems
  • Check relevant monitoring, detection, and logs for exposed assets
  • Track exceptions and retest remediated assets
  • Plan vendor-supported updates through normal change control

Evidence notes

The CVE record and source item provide details on the information disclosure vulnerability in Odoo MCP. However, the corpus does not establish versions beyond 1.3.2, exploitation, impact, or remediation, which require verification from official sources. Additional review of vendor guidance and security advisories is necessary to understand the full scope of the vulnerability and potential mitigations. Defenders should verify the vulnerability in Odoo MCP versions 1.0.0 through 1.3.2 and assess potential information disclosure.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-108861 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-108861

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-108861 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-108861

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Odoo MCP 1.0.0 through 1.3.2 Information Disclosure via execute_method Tool

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108861.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/erpipe-mcp-odoo-execute-method-field-acl-bypass

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://github.com/erpipe-org/mcp-odoo/blob/v1.3.2/src/odoo_mcp/tools_write.py

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/erpipe-org/mcp-odoo

    Supplemental source - product

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/odoo-mcp-1.0.0-through-1.3.2-information-disclosure-via-execute-method-tool

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.